[layer8]

This either requires the destination to accept inbound connections, or you'd need a permanent SSH tunnel, both of which you'd probably want to avoid.